mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
55 lines
1.3 KiB
Text
55 lines
1.3 KiB
Text
function conn_id_string(id: conn_id): string
|
|
{
|
|
return fmt("%s/%d=>%s/%s",
|
|
id$orig_h, id$orig_p,
|
|
id$resp_h, id$resp_p);
|
|
}
|
|
|
|
function connection_state(c: connection, trans: transport_proto): string
|
|
{
|
|
local os = c$orig$state;
|
|
local rs = c$resp$state;
|
|
|
|
local o_inactive = os == TCP_INACTIVE || os == TCP_PARTIAL;
|
|
local r_inactive = rs == TCP_INACTIVE || rs == TCP_PARTIAL;
|
|
|
|
if ( trans == tcp )
|
|
{
|
|
if ( rs == TCP_RESET )
|
|
{
|
|
if ( os == TCP_SYN_SENT || os == TCP_SYN_ACK_SENT ||
|
|
(os == TCP_RESET &&
|
|
c$orig$size == 0 && c$resp$size == 0) )
|
|
return "REJ";
|
|
else if ( o_inactive )
|
|
return "RSTRH";
|
|
else
|
|
return "RSTR";
|
|
}
|
|
else if ( os == TCP_RESET )
|
|
return r_inactive ? "RSTOS0" : "RSTO";
|
|
else if ( rs == TCP_CLOSED && os == TCP_CLOSED )
|
|
return "SF";
|
|
else if ( os == TCP_CLOSED )
|
|
return r_inactive ? "SH" : "S2";
|
|
else if ( rs == TCP_CLOSED )
|
|
return o_inactive ? "SHR" : "S3";
|
|
else if ( os == TCP_SYN_SENT && rs == TCP_INACTIVE )
|
|
return "S0";
|
|
else if ( os == TCP_ESTABLISHED && rs == TCP_ESTABLISHED )
|
|
return "S1";
|
|
else
|
|
return "OTH";
|
|
}
|
|
|
|
else if ( trans == udp )
|
|
{
|
|
if ( os == UDP_ACTIVE )
|
|
return rs == UDP_ACTIVE ? "SF" : "S0";
|
|
else
|
|
return rs == UDP_ACTIVE ? "SHR" : "OTH";
|
|
}
|
|
|
|
else
|
|
return "OTH";
|
|
}
|